CVE-2025-65025

The record

The esm.sh CDN service is vulnerable to a Path Traversal (CWE-22) vulnerability during NPM package tarball extraction. An attacker can craft a malicious NPM package containing specially crafted file paths (e.g., `package/../../tmp/evil.js`). When esm.sh downloads and extracts this package, files may be written to arbitrary locations on the server, escaping the intended extraction directory. Uploading files containing `../` in the path is not allowed on official registries (npm, GitHub), but the `X-Npmrc` header allows specifying any arbitrary registry. By setting the registry to an attacker-controlled server via the `X-Npmrc` header, this vulnerability can be triggered.

Affected packages

Related vulnerabilities

• GO-2025-4138 esm.sh CDN service has arbitrary file write via tarslip in github.com/esm-dev/esm.sh Same vulnerability
• GO-2026-4332 esm.sh has a path traversal in extractPackageTarball enables file writes from malicious… Also affects github.com/esm-dev/esm.sh
• GO-2026-4545 esm.sh is vulnerable to full-response SSRF in github.com/esm-dev/esm.sh Also affects github.com/esm-dev/esm.sh
• CVE-2026-27730 esm.sh is a no-build content delivery network (CDN) for web development. Also affects github.com/esm-dev/esm.sh
• CVE-2025-50180 esm.sh is a no-build content delivery network (CDN) for web development. Also affects github.com/esm-dev/esm.sh
• CVE-2026-23644 esm.sh is a no-build content delivery network (CDN) for web development. Also affects github.com/esm-dev/esm.sh
• GO-2025-4139 esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript in… Also affects github.com/esm-dev/esm.sh
• CVE-2025-65026 esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript Also affects github.com/esm-dev/esm.sh